Hello Netskope Community,
You’ve probably seen some other Netskope publications around GenAI adoption but this one specifically addresses organizations that haven’t started their journey yet and want to leverage a Zero Trust approach when it comes to GenAI apps like ChatGPT and others which have been fueling a lot of development and discussion at organization of all sizes due to its innovation possibilities but also by their perceived risks.
With the recent announcement of the extended license of RBI, admins can utilize our Remote Browser Isolation technology to provide access to apps based on application tags and their observed risk translated through the CCL (Cloud Confidence Level) values. Let's explore two scenarios which are possible by using this approach:
- Company has currently been blocking all GenAI apps but wants to allow access to at least ChatGPT via Remote Browser Isolation so users cannot paste corporate data into it or copy from it but still interact with the Assistant.
- Company currently uses ChatGPT but wants to allow access to other GenAI apps with Low CCL via RBI so preventing copy/paste or file uploads into the sessions.
Use-Case #1 - Block all GenAI apps but allow access to ChatGPT through RBI.
The advantage of this first use-case is that the company can gradually allow access to a single GenAI tool which has been vetted out by the organization but in a safe environment and controlling which interactions can happen in the session. The most powerful advantage provided by RBI in this use-case is the clipboard control which would allow, for example, a marketing person to get ideas on titles for an article but not paste sensitive data to it for data processing.
The first step is to tag the ChatGPT application as a sanctioned application in CCI. Here is an example of how that would look like:
Custom tag named “genai-sanctioned” created
After the application has been properly tagged, you now create an RBI profile that matches the actions that will be allowed inside the RBI session. In this example I'm setting up a profile that doesn’t allow pasting data to prevent sensitive data misuse.
RBI template that prevents pasting data or file uploads
Last step is to create the Real-Time policy that wires together the Generative AI category, the tag and the RBI profile.
Real-Time policy for GenAI apps with the genai-sanctioned tag
Now to conclude this first use-case, let's browse to ChatGPT and see what the result is. Please note the blue frame around it (which by the way, now can be re-colored to match your company corporate identity).
Users can interact but cannot paste or upload files inside the RBI session
Use-Case #2 - Allow restricted access to genAI apps with Medium/Low CCI via RBI.
In this case, sanctioned apps will have direct access but still be protected by Netskope’s DLP, Threat Protection and Analytics, but any other apps with a Medium/Low CCL which translates into a low confidence score can only be accessed via RBI.
Let's use the same RBI profile from before but set up our Real-Time policy to accomplish the desired outcome.
Policy that enables RBI for Low CCL GenAI apps
Now you just need to add another policy with an action set to “allow” for any other sanctioned apps that have the “genai-sanctioned” tag we created in the first use-case.
This is how the result will look like, using askyourpdf.com which has a “Poor” CCL in the Netskope CCI database.
Users can interact but cannot perform high risk activities like paste or upload on Low CCL apps
In both cases, all user interactions will be available in SkopeIT and Advanced Analytics so the organization can track the use of apps and their associated risk promoting informed changes to the policies related to adoption of these new apps.
We demonstrated how RBI can be used to create a gradual adoption strategy for Generative AI apps, since, in addition to the file controls presented by Netskope’s platform it can also perform copy/paste control to the isolated environment resulting on the following business outcomes:
- Reduce intellectual property leak risks
- Prevention of unintentional data sharing
- Maintain data privacy compliance (PCI, HIPAA, GDPR and others)
- Prevent unintended data sharing with 3rd parties
Thanks for reading my article and stay safe out there!